Real-time fan-out uses channel membership cache, not per-message permission reads

Per-message database queries to determine channel membership collapse throughput to whatever the database can handle divided by messages per second. At modest scale — 50 messages per second across 10 channels — that is 50 synchronous permission queries in the hot path, turning a real-time feature into a slow polling system. ISO 25010 performance-efficiency and scalability require that read-hot paths use caching rather than per-operation round trips to persistent storage.

Use the WebSocket framework's built-in room tracking — or an explicit in-memory/Redis membership map — as the fan-out source. Channel membership should be updated on subscribe/unsubscribe, not queried on send.

// Subscribe: update the membership cache once
socket.on('subscribe', async (channel: string) => {
  if (await checkChannelAccess(socket.userId, channel)) {
    socket.join(channel); // Socket.IO maintains membership in-process
  }
});

// Send: fan out from the cache — zero DB queries
socket.on('send_message', (data: { channel: string; content: string }) => {
  io.to(data.channel).emit('message', {
    id: nanoid(),
    content: data.content,
    userId: socket.userId,
    timestamp: Date.now(),
  });
});

// Avoid: querying DB on every send
// const members = await db.select().from(channelMembers).where(...);